spot the error! stripslashes?

[move3rd]

Hi,

I have a form field named "artist" that posts the value "kev's" to the script below:

// Retrieve artist name from another page via $_POST
$artist = $_POST['artist']; 

$edit_profile_button = "<form name=\"profile\" method=\"post\" action=\"edit_profile.php\">
	                    View/Edit ".stripslashes($artist)." Profile<input type='hidden' name='artist' value='$artist'>
                        <input type=\"submit\" name=\"Submit\" value=\"Profile\"></form>";					

$sql = "SELECT * FROM `cds` WHERE `artist` = '$artist'";

$result = mysql_query($sql);

The above outputs a form that is then submited to this script:

// Asign variables from form page via $_POST
$artist = $_POST['artist'];

$sql = "SELECT * FROM `users` WHERE `artist` = '$artist'";

$result = mysql_query($sql);

if (!$result) {
   echo "Could not successfully run query ($sql) from DB: " . mysql_error();
   exit;
              }
//If no nothing is found in the DB display error
if (mysql_num_rows($result) == 0) {
	echo "$report_error<h4 align=center>".stripslashes($artist)." there is a problem please contact the webmaster and quote this ref number</h4>";  

   exit;
                                  }

I'm getting an error at: if (mysql_num_rows($result) == 0)

The error displays the value arist as "kev\" even though I've used stripslahses.

Sugestions much apreciated

[weekender]

try doing it without stripslashes?

[LordShryku]

Of course.....how is MySQL supposed to know where the value ends given this..

SELECT * FROM `users` WHERE `artist` = [b]'kev's'[/b]

[move3rd]

I'm not actually using stripslashes() on the value/variable. I'm only using stripslashes() where the value will actually be displayed.

[move3rd]

LordShryku,

I was recently told I didnt need to use addslashs as php automaticaly adds them.

I'm I missing somthing here?

[LordShryku]

If magic_quotes_gpc is on, it will add them automatically, but you can't strip them out if you're going to use them in a query. MySQL needs the slashes there also.

If you're not using them, have you tried echoing the sql to the screen to see what it looks like?

[jasonmills58]

Well, sometimes it adds them automatically, and sometimes it
doesn't. It depends on your installation's settings. I have found that if I
just store the info in the first place using addslashes() then I don't even
need stripslashes later.

[move3rd]

Originally posted by LordShryku
If magic_quotes_gpc is on, it will add them automatically, but you can't strip them out if you're going to use them in a query. MySQL needs the slashes there also.

magic_quotes_gpc is on. You can see in my code that I'm not using stripslashes on any of the variables used in the sql query.

If you're not using them, have you tried echoing the sql to the screen to see what it looks like?

Thepage that holds the form that posts to my first script correctly displays the $artist variable (kev's) when I use stripslashes (though I do not use stripslashes on the form value only it's name)

[move3rd]

bump

[jasonmills58]

Now thats just annoying - and after only 2 and half hours. Apparently you haven't heard how they feel about bumping around here...

[LordShryku]

Originally posted by LordShryku
have you tried echoing the sql to the screen to see what it looks like?

Originally posted by move3rd
Thepage that holds the form that posts to my first script correctly displays the $artist variable (kev's) when I use stripslashes (though I do not use stripslashes on the form value only it's name)

So.....have you echoed the sql?

Bumping will leave you 2b LHTD btw.

[move3rd]

I wasnt aware no...

[move3rd]

I can only apoligise for my lack of thought!(bumping)

I echo'd the sql:

SELECT * FROM users WHERE artist = 'kev\'

[LordShryku]

Okay, so now that makes sense. On any post, it's going to add slashes where needed. So if you trekked through a couple forms without stripping slashes on each one, carrying the same hidden input variable, you would have three slashes. PHP isn't very "smart" in this fashion. Use stripslashes on your hidden input, and you should end up with only one slash, instead of the two.

[move3rd]

I add stripslashes to the $artist variable in my hidden form fields.

The echo'd sql is now outputing:

SELECT * FROM users WHERE artist = 'kev'

when it should be:

SELECT * FROM users WHERE artist = 'kev\'s'

[laserlight]

um, did you follow xhtml's rule and enclosed all attribute values in (double) quotes?

[move3rd]

Originally posted by laserlight
um, did you follow xhtml's rule and enclosed all attribute values in (double) quotes?

Which values?

You mean stripslashes($artist)

I'm not sure what you mean?

[move3rd]

I found that some of my forms used double quotes and some used single. I re-wrote them and my scipts are now working correctly.

Thanks for your help everone!🆒